Prepare MessageCenter 0.1.0

[bwente]

Summary

• establish the normalized urgency and retention message contract with bounded in-memory history, deduplication, expiration, and individual acknowledgement or dismissal
• add webhook, optional MQTT, optional Unix-domain-socket, MagicMirror weather, and explicitly allowlisted MMM-Remote-Control ingestion
• cache optional JPEG, PNG, and WebP snapshots at ingestion with conservative network, type, size, timeout, redirect, rolling-count, and total-byte controls
• provide full-page, compact, and non-touch presentation modes for standard MagicMirror installations
• refine semantic attention state, channel routing, locale-aware timestamps, stable update ordering, and background-agnostic styling
• add integration-neutral attention configuration with backward compatibility
• add GitHub Actions CI, Dependabot, MIT licensing, release metadata, changelog, roadmap, preview, and live-test documentation

Why

This consolidates the Pi-tested MessageCenter foundation into a standalone, hardware-independent 0.1.0 baseline. Compact and non-touch modes make MessageCenter a first-class MagicMirror module without requiring MMM-pages, Seymour, or a hardware adapter. Optional MQTT and local sockets let smart-home and system-monitoring producers use the same schema, while cached snapshots preserve the image associated with an event instead of showing a later camera frame.

Security and resource limits

• the webhook binds to localhost by default; LAN access requires explicit configuration
• optional transports are disabled by default and credentials remain in private MagicMirror configuration
• external payloads are limited to 32 KiB
• image fetching is disabled by default, limited to 1 MiB and five seconds, validates file signatures, and blocks private hosts and unencrypted HTTP unless separately enabled
• original image URLs are not passed to the browser
• all history is capped at 50 messages by default
• the newest 12 images are retained within a 12 MiB decoded-byte budget; older messages keep their text and state after image eviction

Validation

• npm test — 88 tests passing
• npm audit --omit=dev --audit-level=high — zero vulnerabilities
• npm pack --dry-run — successful with an isolated temporary npm cache
• GitHub Actions workflow and Dependabot YAML parse successfully
• git diff --check — clean
• reviewed for credentials, private hosts, LAN addresses, personal payloads, and unrelated files